Is this the Launch Site of the Missile that Shot Down Flight MH17? A Look at the Claims and Evidence
Translations:
In a previous investigation related to the 17 July 2014 downing of Malaysian Airlines Flight 17 (MH17) in eastern Ukraine, the Bellingcat investigation team provided the origin and movements of a Buk M1 missile launcher filmed and photographed that same day that travelled from Donetsk past Zuhres, through Torez and Snizhne. Before reaching Snizhne, the Buk M1 missile launcher was transported on a red low-loader hauled by a white Volvo truck featuring a telephone number and unique blue stripes. In Snizhne, however, the Buk was unloaded off the hauler and driven south out of Snizhne under its own power. In the early hours of 18 July 2014 the missile launcher was spotted in Luhansk, where it was again being hauled by the same white Volvo truck, but this time it was missing one missile.
The location of the Buk between its last sighting in Snizhne and its appearance in Luhansk the following morning is a vital question that will shed light on the culprits and circumstances of the MH17 tragedy. This report will consider four vital clues that allow us to estimate the launch location for the missile that downed MH17: 1) photographs of a white smoke trail taken a few moments after the crash of flight MH17, 2) visible burn damage to a wheat field that appeared between 16 and 20 July 2014, 3) audio recordings reportedly from 17 July 2014, and 4) a US intelligence satellite image from 22 July 2014.
Two hours after the crash of the MH17, a photograph that showed a vertical white smoke trail and a smaller grey smoke patch to the left of the white smoke trail was posted on Twitter by someone who claimed that this photograph, provided by an anonymous photographer, depicted the launch site of the Buk launcher that downed MH17. A few days later, a number of bloggers geolocated features in the image, including the approximate location of the photographer and an approximate origin point of the white smoke trail. In December, the photographer provided additional photographs, and a Dutch news outlet enlisted the help of outside research experts to review the pictures. They assessed that they were authentic.
On 20 July, 1 August, and 15 August 2014, Google updated its satellite imagery to include images of Snizhne and Torez, revealing suspicious tracks in wheat fields and a part of what seemed to be a burned wheat field with scorched earth south of Snizhne.
On 22 July 2014, US intelligence officials published a blurry black and white satellite image with the flight paths of both MH17 and the Buk M1 missile that downed the passenger plane. Because of the relative low quality of the image, many were disappointed by the declassified intelligence. However, after re-examining this image, it turned out to be far more informative than first thought.
On 24 July 2014, conversations in Snizhne and Torez over the smartphone app Zello recorded at the time of the downing of MH17 were posted on YouTube. One conversation was of a woman recounting that she saw a missile flying overhead while she was in a garden and describing the direction of the missile. In addition, tapped phone conversations on 17 July 2014 between pro-Russian separatists published by the Security Service of Ukraine (SBU) provided information about the destination of the Buk missile launcher on 17 July 2014.
In consideration of all of these clues, this report concludes that the likely missile launch location was in a burned wheat field south of Snizhne.
The Separatists’ Buk Missile Launcher in Snizhne
In Bellingcat’s earlier investigation, “Origin of the Separatists’ Buk,” the Bellingcat investigation team established the route of the Buk on 17 July 2014: Donetsk to Zuhres to Torez to Snizhne and then to Luhansk the following morning. The first of two Snizhne sightings took place in the center of the city, where it was moving under its own power. A photograph taken of the missile launcher was posted on Twitter on 18 July, and after this photograph was taken, a video was shot of the missile launcher driving south through Snizhne. This video was first posted on YouTube on 17 July 2014. Both the picture and the video have been geolocated by Bellingcat and others.
The picture and video raise two important questions: Why was the Buk headed south toward the city limits of Snizhne? And why was the Buk no longer being hauled and instead driving under its own power? From various sources it is apparent that from July until the end of August, an ongoing battle between pro-Russian separatists and the Ukrainian army was taking place south of Snizhne in the villages of Stepanivka, Marynivka, and near the monument hill of Savur-Mohila in Saurivka. The road south of Snizhne (T0522) leads directly to this area, so it is possible that the Buk intended to provide anti-air support in the area. This may shed some light on the second question, as the Buk must be unloaded from the truck in order to fire its missile.
Map of the area south of Snizhne on Google Maps with the conflict area in a green circle, the location of the picture of a Buk M1 missile launcher in a small red circle and the location of the video of a Buk M1 missile launcher in a small blue circle.
To our knowledge, no other pictures or videos have been made of the Buk M1 missile launcher in this area, and only one other video was posted on YouTube on 18 July 2014 of the missile launcher being hauled again by the white Volvo truck in Luhansk, this time clearly missing one missile.
July 2014 photographs of the white smoke trail
Just three hours after the crash of MH17, a picture was published on Twitter that appeared to show a ropeway on the horizon between “Lutugina” and “Tsof” in the area of Torez, which is close to Snizhne. The image was posted at 7:23 PM local time, three hours after the crash of Flight MH17.
Several claims have been made that assert that the picture was a fabrication of the Security Service of Ukraine (SBU). This is unlikely for the following reasons: The photograph was posted only three hours after the MH17 crash, the general location of the white smoke trail is in the same area where the Buk was seen heading toward when last seen in Snizhne, and the weather matches that of July 17 as demonstrated in subsequent photographs that were released. Additionally, the SBU did not share this photograph until two days later, while, in contrast, the 18 July 2014 Luhansk video was released very quickly by the SBU itself. The photograph did not appear on any official Ukrainian channels before it was posted on Twitter, and the earliest posting of the photograph by a Ukrainian official was by Ministry of Internal Affairs official Anton Gerashchenko on Facebook at 7:45 PM (local time).
On 21 July 2014, the blogger Ukraine@War geolocated the photograph. The Bellingcat investigation team has verified the geolocation, which indicates that the photograph was taken north of Torez in the direction of a mine in eastern Torez. A detailed look at the geolocation of this photograph can be found here.
Dutch news outlet RTL Nieuws conducted an interview with the anonymous photographer of the white smoke trail in December 2014. Along with the interview, RTL Nieuws acquired additional photographs taken right after the original photograph in the same location. Two research organizations, FOX-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and TuDelft (the Technical University in Delft), examined the white smoke trail and geolocated the photographs. The anonymous photographer has given the original photographs, including the memory card holding them, to the official Dutch investigation of the downing of MH17.
Second picture taken on 17 July 2014 from the north of Torez.
Considering the previous geolocation evidence, there can be no doubt that the photographs that claim to show the Buk launch site from 17 July 2014 were taken from northern Torez and show the area of eastern Torez near the Lutugina mine in the direction south of Snizhne.
Authenticity of photographs
There have been many claims that the 17 July 2014 pictures are not genuine, manipulated, or were taken at a different date.
As part of this investigation, Bellingcat contacted the photographer who took the smoke trail images, and provided the images in a RAW image format. To protect the privacy and safety of the photographer, we have decided not to publish anything about the exact file type of the pictures or any other metadata, as it would reveal the type of camera the photographer used. What we will publish is that the second published picture was taken first at 16:25:41 EEST, and the first published picture was taken 7 seconds later at 16:25:48 EEST. According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.
Images in a RAW format can be edited in photo editing software and saved as a different format, like BMP, JPG, PNG, TIFF, etc., but this will always result in a different file date, namely, the date and time the file has been saved after editing. Photo editing software is not able to save files in a RAW format, because this is not a “positive” image format. In addition, because pictures can only be edited by photo editing software, changes to the pictures will always result in modified metadata.
While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.
Based on the metadata of the RAW files we received, we can be completely certain that these files are the original files and that the pictures were taken on 17 July 2014 at 16:25:41 EEST and 16:25:48 EEST, according to the date and time set in the camera. Though it is possible to set the camera itself to a different date and time, when we take into account that the first picture was released two hours after the crash, the only scenario where what we see on the pictures is not the launch of the Buk missile that was seen above eastern Torez on 17 July 2014 is that the photographer took a picture of a missile launch on a previous date, and his camera date and time was inadvertently set to 17 July 2014 at 16:25 EEST. The probability of this being the case, of course, is close to zero.
Another interesting detail noted by the Bellingcat investigation team is that, based on the movement of the smoke between the photographs, the smoke was moving toward the east, which corresponds to reports about the wind direction that day. The weather conditions in the photos are also consistent with the weather conditions that day, with clouds visible in the unzoomed photograph. A more detailed examination of the photographs can be found here.
Full-sized, uncompressed copies of the original RAW files can be found here.
The Possible Launch Location
With the smoke photographs geolocated, it was then possible to establish where the smoke was originating from. Early attempts by the person who tweeted the original photograph and the Ukraine@War blog pointed to fields to the south of Snizhne, where the Buk filmed heading out of Snizhne would have had easy access. The following image was created based on Bellingcat’s own geolocation and analysis of the photograph and closely matches the work done previously on Ukraine@War:
View lines of the first picture of 17 July 2014 with the view frame (blue lines), the view lines of the white smoke trail (red lines) and the view lines of the smaller grey smoke trail (brown lines).
On 20 July 2014, social news agency Storyful shared satellite map imagery taken the same day that showed areas south of Snizhne, including the road the Buk missile launcher was filmed heading south on three days earlier and the fields at the end of that road. Track marks in those fields were noted by a number of individuals, including Ukraine@War and Roland Oliphant, a reporter with the Daily Telegraph who visited the area.
Oliphant discovered one field where a corner had been burnt over a wide area. He took a number of photographs, which were subsequently used by the Ukraine@War blog to geolocate the exact location of the field. This geolocation has been reviewed and confirmed by the Bellingcat investigation team and shows a field just south of where the tracks were visible on the 20 July 2014 satellite map imagery.
Part of a wheat field where scorched earth and burned wheat was seen by Roland Oliphant of the Telegraph from 15 August 2014 satellite image.
In the map below, the partly burnt and ploughed area of the field has been highlighted in yellow, and is in line with where the grey smoke was visible on the photographs of the smoke trail, marked with brown lines:
Audio Recordings
Shortly after the downing of Malaysian Airlines Flight 17 (MH17) on July 17th, an audio clip was shared on social media sites claiming to be a recording of civilians near the town of Snizhne discussing the crash on the audio chat application Zello. Zello is a popular service in separatist areas, and this particular recording purports to capture what would be a key discussion about events on July 17th.
The individuals in the video describe both an “upward” missile launch and the crash of MH17. While it is difficult to independently verify the authenticity of the audio, it is possible to compare what is described in the audio with other evidence about the downing of MH17, including the launch location of the missile.
Multiple times throughout the recording, people are heard referring to the location they are in or the location where they can see something happening. Two people talk about KhimMash (Химмаш in Russian), an industrial plant to the north of Snizhne, probably because they saw smoke rising from north of Snizhne. Other locations, like “mine 8” (“Шахта №8”) in the west of Snizhne and “Cheryomushky” (“Черемушки”) next to the KhimMash plant, are also mentioned, but one person describes a missile flying over her while she was in a garden. She says the missile came from the direction of Saurivka, a small village to the south of Snizhne near Stepanivka, where the Savur-Mohyla monument is located. The woman claims that the loud noise of the launch caused her to seek shelter in the basement of her home with her mother. This would seem to indicate the missile was launched relatively close to her house.
The woman describes herself as being in “Oktyabr” (“Октябрь”), which can be found south of Snizhne on the Russian Yandex Maps site:
With some uncertainty, she goes on to describe the direction she believes the missile was launched from, namely, Saurivka, which is south-southeast of her location.
On 18 July, the Security Service of Ukraine (SBU) published another audio recording relevant to identifying the missile launch location. In this conversation, we first hear separatists talking about a Buk M1 surface-to-air missile system and later that the Buk is in Donetsk. We then hear that the Buk was unloaded somewhere and driving under its own power and that the Buk has to be delivered to an area nearby called “Pervomaiskoe.”
A search for this location yielded a “Pervomaiske” near Donetsk, a “Pervomaisk” near Luhansk, a “Pervomaisk” near Mykolaiv, a “Pervomaskyi” near Kharkiv, a “Pervomaiske” near Dnipropetrovsk, a “Pervomaiskyi” to the southeast of Snizhne, and another village north of Snizhne called “Pervomaiske.”
The image below shows the locations mentioned in the audio recordings in relation to the suspected launch site visited by Roland Oliphant:
US Intelligence Satellite Map Imagery
On July 22nd, 2014, US intelligence officials published a black and white satellite map image showing what they claimed to be the path of the Buk missile that downed MH17.
Although the map marks Snizhne as the launch site of the missile, the exact location of the site was not immediately clear due to the quality of the image.
While the quality of the declassified satellite map image is relatively poor, it is nonetheless possible to find the approximate launch site indicated on the map. Certain large geographical features are visible on the satellite map image, and by examining Google Earth satellite map imagery, it is possible to find these same features.
For instance, there is a curved lake and two areas of forest northeast of the location identified as the launch site:
To the southwest, there are a series of small lakes running north to south which match perfectly with what is visible on both sets of satellite map imagery:
Zooming in closer, we can make out other features, including an oddly shaped field just south of the launch location:
The oddly shaped field is a just to the south of the village Chervonyi Zhovten, which is north of the Savur-Mohila monument in Saurivka and slightly west of Stepanivka. Due to the width of the line and the resolution of the US satellite map imagery it is not possible to find the exact location the line originates from, but it appears that it would be very close to the area where the lines below intersect, south of Snizhne:
Based on the image above, the line comes very close to originating from the suspected launch site:
Conclusion
Based on the foregoing information, it seems clear there are a number of pieces of evidence pointing toward one specific location south of Snizhne. Photographs published online two hours after MH17 was shot down point directly to an area that is clearly visible on satellite map imagery, showing a field that was unburnt on 16 July 2014 but visibly burnt only a few days after that date. On 17 July 2014, a Buk missile launcher was filmed only a few kilometres to the north of this site heading south in the direction of the location we have identified. US intelligence also points to the same field, and audio recordings, while difficult to authenticate, also point to roughly the same area.
Taken separately, these pieces of evidence are not particularly compelling. When combined, however, they provide strong support for the assertion that the missile that downed MH17 originated from the potential launch site we have identified.
